Analysis

  • max time kernel
    42s
  • max time network
    155s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    22-02-2024 22:06

General

  • Target

    7c7e4213746a2816953fc46ce73e69a1b38ded44263a810a4eaedde8511800a2.apk

  • Size

    1.1MB

  • MD5

    a9cb55488b48219352f8c0eb7b5c3b72

  • SHA1

    5bd952beda27c8c16d88a3ac5e55a1ff9f1e67ef

  • SHA256

    7c7e4213746a2816953fc46ce73e69a1b38ded44263a810a4eaedde8511800a2

  • SHA512

    9fb71720a0a6322e2d86fa349cb9c5dcdc78fe2e2f93601d403bf4ea1b87488d0b8006e3b0dd5cf29d08d6f525f919e9fa47e13c7bb9cd54b48fab8622f6e246

  • SSDEEP

    24576:f0AVatewyf+fWGsGzGYPz2LXR5yPkoMOgSYv:M+j2fWGPXyDD2TgSE

Malware Config

Extracted

Family

hook

C2

http://93.123.39.169

AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.tencent.mm
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4275

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    91556b1a6723a1e258bdf0bf2571f37d

    SHA1

    d13b19eaa9659f3214e8a2187a21c1e6ec0feb60

    SHA256

    f17db38b2cc8b8d1672b3e3ad12440f1003af1f0cc11042dbee0f87eaf52d86d

    SHA512

    01a5fa3c0f313e3f2f23ea9d21ab7a96fecec27fdf9a9f2ad96a312b693e76250902cf6213936d05601c07fbe9ceb9d5e7722415f1b4dbeddfd2139628827800

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

    Filesize

    28KB

    MD5

    cf845a781c107ec1346e849c9dd1b7e8

    SHA1

    b44ccc7f7d519352422e59ee8b0bdbac881768a7

    SHA256

    18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

    SHA512

    4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    33b757a9543e08abc2532108c8245347

    SHA1

    4ee543a8e42d29e85f6bc48cd13949e0b02e5fd7

    SHA256

    63eb8f970fcdfb999cd32e9d92d0888f6837afbb44581b43fb9ee18e0bbed1ba

    SHA512

    711a9d2025efa31a4f6411c163d7a58469aa88487843a00804347bea09d8a9852ededaf0395ba49c2b3458398b120a9d8024c43c20e321be32acbce23f5aa189

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    7099c77c4f1500d7e8718e6b093fada7

    SHA1

    09febd4d1aa6f27725e62f4e8248000038e5fea5

    SHA256

    2080335e9e6f6913abb9e45913cf085b9f02891d327541cc558748dcb5599aac

    SHA512

    ec9315e0bf27e14155fa978c5cd722c4de9e9cc5d1368e8cead792ff74506cef7081f089f4b8c3cfaefedda6b829d972aff6944d7ba06d6eee76fde6ba740bb6

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    173KB

    MD5

    13ecc56ac7eabb679781ee8c7c441eeb

    SHA1

    4b4654d042d9a177ee1d35ca6c43f8119b7d1ace

    SHA256

    24b9b92d6b87f7aeaa3d58a5da95fc881608a591be5baee14afa493be69e7fa3

    SHA512

    f47315575fa723c2fcfbb3ad5afa95028a1b4b10e8838751140960ec1e3188136a8c9da8f2930cc12188a9eefd132ce2e3e6205efd0465dc9bb909f3c34382eb